Options

AVAST inform me that "too many identical mails are sent in a short period of time"

Unknown
edited January 2010 in Spyware & Virus Removal
Hello,

It seems that my PC has a virus.. Zone alarm and Avast are running on my Windows XP machine.
Avast sent me alerts on mails: 'there is to many identical mails sent in a short period of time" (direct tranlation from french into ENglish... sorry if it is not the exact translation)..
I have ran a HJT and a Malwarebytes analysis (which sounds almost chinese for me.. )..
Can you please help me to analyse what's going wrong? :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:41:41, on 14/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16945)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead
Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD
LE\USBDeviceService.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD
LE\DetectorApp.exe
C:\Program Files\Fichiers
communs\InstallShield\UpdateService\issch.exe
C:\APPS\Powercinema\PCMService.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\drivers\PhiBtn.exe
C:\WINDOWS\System32\drivers\Tray900.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Search Guard Plus\SearchGuardPlus.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\APPS\SMP\SmpSys.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Documents and Settings\Paca_SuperStar\Application
Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start
Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet
Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start
Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet
Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Connection
Wizard,ShellNext = http://www.avast.com/
R1 - HKCU\Software\Microsoft\Internet
Explorer\Main,Window Title = Packard Bell
R0 - HKCU\Software\Microsoft\Internet
Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-
4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat
7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-
90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-
D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07
\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion
Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} -
C:\Program Files\Fichiers communs\Microsoft
Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-
3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1
\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32
\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32
\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SynTPLpr] C:\Program
Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program
Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés
de High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program
Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [DetectorApp] C:\Program
Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1
\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program
Files\Fichiers
communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCMService]
"c:\APPS\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4
\ashDisp.exe
O4 - HKLM\..\Run: [PhiBtn] %SystemRoot%\System32
\drivers\PhiBtn.exe
O4 - HKLM\..\Run: [Traymin900] %SystemRoot%\System32
\drivers\Tray900.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SGPUpdater] C:\Program Files\Search
Guard PlusU\sgpUpdaters.exe
O4 - HKLM\..\Run: [FBSearch] C:\Program Files\Search
Guard Plus\SearchGuardPlus.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program
Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program
Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
AcRdB7_1_0
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32
\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows
Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and
Settings\Paca_SuperStar\Local Settings\Application
Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE]
C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE]
C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE]
C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE]
C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Notification de cadeaux MSN.lnk =
C:\Documents and Settings\Paca_SuperStar\Application
Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program
Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk
= C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Add to Google Photos
Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xporter vers Microsoft
Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11
\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - C:\Program Files\Java\jre1.6.0_07
\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-
3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11
\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-
00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-
f2ba38496583} - C:\WINDOWS\Network
Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -
{e2e2dd38-d088-4134-82b7-f2ba38496583} -
C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O14 - IERESET.INF:
START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000}
(Shockwave Flash Object) -
http://fpdownload2.macromedia.com/get/shockwave/cabs/flas
h/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-
1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: AOL Connectivity Service (AOL ACS) -
America Online, Inc. - C:\PROGRA~1\FICHIE~1
\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) -
ALWIL Software - C:\Program Files\Alwil Software\Avast4
\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software -
C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software -
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software -
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Background Capture Service
(CBCS) (CLCapSvc) - Unknown owner -
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) -
Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service -
Cyberlink -
c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Google Updater Service (gusvc) - Google -
C:\Program Files\Google\Common\Google
Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) -
NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper)
- Ulead Systems, Inc. - C:\Program Files\Fichiers
communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner -
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD
LE\USBDeviceService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone
Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 9900 bytes

I also ran a Malwarebytes analysis (below the report); 53 files have been quarantined. I rebooted my PC but it is stll infested.
Malwarebytes' Anti-Malware 1.42
Version de la base de données: 3356
Windows 5.1.2600 Service Pack 2
Internet Explorer 7.0.5730.13
14/12/2009 00:18:10
mbam-log-2009-12-14 (00-17-57).txt
Type de recherche: Examen rapide
Eléments examinés: 107214
Temps écoulé: 11 minute(s), 5 second(s)
Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 4
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 44
Processus mémoire infecté(s):
(Aucun élément nuisible détecté)
Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)
Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\pbfrv2.pbfrv2 (Adware.2020search) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d} (Adware.2020search) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d} (Adware.2020search) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d} (Adware.2020search) -> No action taken.
Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d} (Adware.2020search) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{4e7bd74f-2b8d-469e-a0e8-ed6ab685fa7d} (Adware.2020search) -> No action taken.
Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)
Dossier(s) infecté(s):
C:\Program Files\dynamic toolbar (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2 (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache (Adware.2020search) -> No action taken.
Fichier(s) infecté(s):
C:\Program Files\dynamic toolbar\batch.bat (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\unins000.dat (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\unins000.exe (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\go.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\home.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\logo_pb.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\parent_off.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\parent_on.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\pbfrv2tb0200.cfg (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\popup_off.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\popup_on.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\search.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\services.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\skin.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\skin1.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\skin2.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\skin3.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\skin4.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\skin5.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\store.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\style.css (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\support.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\Cache\ticker.xml (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\go.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\home.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\logo_pb.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\parent_off.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\parent_on.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\pbfrv2tb0200.cfg (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\popup_off.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\popup_on.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\search.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\services.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin1.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin2.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin3.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin4.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin5.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\store.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\style.css (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\support.bmp (Adware.2020search) -> No action taken.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\ticker.xml (Adware.2020search) -> No action taken.
C:\Documents and Settings\Paca_SuperStar\Menu Démarrer\Programmes\Démarrage\siszyd32.exe (Trojan.Agent) -> No action taken.


Many thanks,

Comments

  • chiazchiaz
    edited December 2009
    Hi,

    A few things before we start....
    1. Please Read All Instructions Carefully.
    2. If you don't understand something, stop and ask! Don't keep going on.
    3. Please do not run any other tools or scans whilst I am helping you.
    4. If you have to go away for an extended period of time, let me know.
    5. Please continue to respond until I give you the "All Clear".
    (Just because you can't see a problem doesn't mean it isn't there)


    Let's have you download ComboFix.exe. Please visit this webpage for downloading and instructions for running the tool:

    Go here ======> A guide and tutorial on using ComboFix <====== Go here

    Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use the download meant for SP2.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should get a prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    (1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    (2) Click Yes to allow ComboFix to continue scanning for malware.

    When the tool is finished, it will produce a report for you.


    Please include the MBAM log as well as a new HijackThis log for further review, so that we may continue cleansing the system.


    Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.
  • Sunshine
    edited December 2009
    Many txs for taking my case.

    I read the guide but ComboFix is not available for download at the moment. (it is written on the download webpage that an issue with the program has to be resolved)
    I'll try again later .. .

    Rgds,
    Pascale
  • chiazchiaz
    edited December 2009
    Yes indeed I had posted that before being made aware of it being taken down.

    We don't absolutely have to rely on it though. If you'll post a new HijackThis log, we'll take it from there.
  • Sunshine
    edited December 2009
    I'll try again ComboFix tonight when i am back home.
    If it is still not available, I ll ran a new HijackThis.

    Rgds,
    Pascale
  • Sunshine
    edited December 2009
    ComboFix is still not available. Below the new HijackThis log generated a minute go.
    I have no idea if this is of any help but in the same time, AVAST sent me a warning saying that it found a suspect file with the heuristic method:
    C:\WINDOWS\System32\Drivers\knvppt.sys (file type: hidden services)
    I had to choose between "delete now" and "ignore".
    I choose "ignore" as it is recommended not to change anything while you are working.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:19:38, on 15/12/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16945)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
    c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
    c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
    C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
    c:\APPS\Powercinema\Kernel\TV\CLSched.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
    C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
    C:\APPS\Powercinema\PCMService.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\System32\drivers\PhiBtn.exe
    C:\WINDOWS\System32\drivers\Tray900.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Search Guard PlusU\sgpUpdaters.exe
    C:\Program Files\Search Guard Plus\SearchGuardPlus.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\APPS\SMP\SmpSys.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Documents and Settings\Paca_SuperStar\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\Documents and Settings\Paca_SuperStar\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
    C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
    C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
    C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
    C:\Program Files\Alwil Software\Avast4\setup\avast.setup
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?

    LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?

    LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?

    LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?

    LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.avast.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

    Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07

    \bin\ssv.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-

    5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Search Assistant - {F0626A63-410B-45E2-99A1-3F2475B2D695} - C:\Program Files\SGPSA\BHO.dll
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe"

    -start
    O4 - HKLM\..\Run: [PCMService] "c:\APPS\Powercinema\PCMService.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [PhiBtn] %SystemRoot%\System32\drivers\PhiBtn.exe
    O4 - HKLM\..\Run: [Traymin900] %SystemRoot%\System32\drivers\Tray900.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SGPUpdater] C:\Program Files\Search Guard PlusU\sgpUpdaters.exe
    O4 - HKLM\..\Run: [FBSearch] C:\Program Files\Search Guard Plus\SearchGuardPlus.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Paca_SuperStar\Local Settings\Application

    Data\Google\Update\GoogleUpdate.exe" /c
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\Paca_SuperStar\Application

    Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
    O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0

    \Reader\reader_sl.exe
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11

    \EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07

    \bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

    Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11

    \REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

    Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

    C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

    Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

    Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

    http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1

    \Skype\SKYPE4~1.DLL
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1

    \AOL\ACS\AOLacsd.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil

    Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner -

    c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner -

    c:\APPS\Powercinema\Kernel\TV\CLSched.exe
    O23 - Service: CyberLink Media Library Service - Cyberlink -

    c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google

    Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers

    communs\Ulead Systems\DVD\ULCDRSvr.exe
    O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD

    LE\USBDeviceService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32

    \ZoneLabs\vsmon.exe

    --
    End of file - 10173 bytes

    Rgds,
    Pascale
  • chiazchiaz
    edited December 2009
    Sorry for the late response.


    Please go to Control Panel > Add/Remove Programs and uninstall the following if found:
    My Web Tattoo
    Search Guard PlusU
    Search Guard Plus

    Reboot your PC.

    I need you to download and run ComboFix now, using the same instructions I posted above.
    However, the download link can be found here:
    http://download.bleepingcomputer.com/sUBs/Beta/KittyFix.exe

    Post CFScript.txt as well as a new HijackThis log in your reply, and we'll take it from there.
  • Sunshine
    edited December 2009
    Hello,

    I have uninstalled Search Guard Plus and Search Guard Plus Updater programs.
    However, I did not found My Web Tatoo in the list.

    Then I have deactivated avast and ran the program downloaded from the link you set me.

    Here is the log:
    ComboFix 09-12-18.02 - Paca_SuperStar 19/12/2009 12:25:26.1.2 - x86
    Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.895.430 [GMT 1:00]
    Lancé depuis: c:\program files\kittyfix\KittyFix.exe
    AV: avast! antivirus 4.8.1368 [VPS 091218-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
    FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\Paca_SuperStar\Application Data\avdrn.dat
    c:\recycler\S-1-5-21-1315934814-3113650785-609295344-1003

    .
    ((((((((((((((((((((((((((((( Fichiers créés du 2009-11-19 au 2009-12-19 ))))))))))))))))))))))))))))))))))))
    .

    2009-12-19 11:19 . 2009-12-19 11:20
    d
    w- c:\program files\kittyfix
    2009-12-18 18:45 . 2007-12-24 16:37 138384 ----a-w- c:\windows\system32\drivers\tmcomm.sys
    2009-12-18 18:43 . 2009-12-19 11:07
    d
    w- c:\windows\system32\HouseCall 6.6
    2009-12-13 23:03 . 2009-12-13 23:03
    d
    w- c:\documents and settings\Paca_SuperStar\Application Data\Malwarebytes
    2009-12-13 23:03 . 2009-12-03 15:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-12-13 23:03 . 2009-12-13 23:03
    d
    w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-12-13 23:03 . 2009-12-13 23:03
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-12-13 23:03 . 2009-12-03 15:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-12-13 22:37 . 2009-12-13 22:37
    d
    w- c:\program files\Trend Micro
    2009-12-13 22:14 . 2009-12-19 11:33 697856 ----a-w- c:\windows\system32\drivers\knvppt.sys
    2009-12-13 22:12 . 2009-12-13 22:12 116 ----a-w- c:\windows\system32\fjhdyfhsn.bat
    2009-12-04 09:03 . 2009-12-04 09:03 251376 ----a-w- c:\documents and settings\Paca_SuperStar\Application Data\Mozilla\plugins\npgoogletalk.dll

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-12-19 11:32 . 2008-07-27 11:57 1239072 --sha-w- c:\windows\system32\drivers\fidbox.dat
    2009-12-19 11:16 . 2008-06-14 11:44
    d
    w- c:\documents and settings\Paca_SuperStar\Application Data\OpenOffice.org2
    2009-12-19 11:12 . 2008-07-27 11:57 14732 --sha-w- c:\windows\system32\drivers\fidbox.idx
    2009-12-14 22:39 . 2004-08-16 15:41 85842 ----a-w- c:\windows\system32\perfc00C.dat
    2009-12-14 22:39 . 2004-08-16 15:41 513736 ----a-w- c:\windows\system32\perfh00C.dat
    2009-12-13 22:13 . 2009-12-13 22:12 16 ----a-w- c:\windows\system32\config\systemprofile\Application Data\fvgqad.dat
    2009-12-12 00:14 . 2008-06-14 11:08 4212 ---h--w- c:\windows\system32\zllictbl.dat
    2009-11-24 23:54 . 2008-06-14 10:38 1280480 ----a-w- c:\windows\system32\aswBoot.exe
    2009-11-24 23:51 . 2008-06-14 10:39 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
    2009-11-24 23:50 . 2008-06-14 10:39 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
    2009-11-24 23:50 . 2008-06-14 10:39 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2009-11-24 23:50 . 2008-06-14 10:39 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2009-11-24 23:49 . 2008-06-14 10:39 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2009-11-24 23:48 . 2008-06-14 10:39 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2009-11-24 23:47 . 2008-06-14 10:39 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
    2009-11-24 23:47 . 2008-06-14 10:39 97480 ----a-w- c:\windows\system32\AvastSS.scr
    2009-11-17 21:05 . 2008-07-07 20:05
    d
    w- c:\documents and settings\Paca_SuperStar\Application Data\dvdcss
    2009-11-11 21:34 . 2008-06-14 14:43
    d
    w- c:\program files\Google
    2009-10-29 07:44 . 2004-08-16 15:41 832512 ----a-w- c:\windows\system32\wininet.dll
    2009-10-29 07:44 . 2004-08-16 15:40 78336 ----a-w- c:\windows\system32\ieencode.dll
    2009-10-29 07:44 . 2004-08-16 15:40 17408
    w- c:\windows\system32\corpol.dll
    2009-10-21 06:03 . 2004-08-16 15:41 75776 ----a-w- c:\windows\system32\strmfilt.dll
    2009-10-21 06:03 . 2004-08-16 15:40 25088 ----a-w- c:\windows\system32\httpapi.dll
    2009-10-20 14:58 . 2004-08-03 21:00 263552 ----a-w- c:\windows\system32\drivers\http.sys
    2009-10-13 10:52 . 2004-08-16 15:40 267776 ----a-w- c:\windows\system32\oakley.dll
    2009-10-12 13:52 . 2004-08-16 15:41 113152 ----a-w- c:\windows\system32\rastls.dll
    2009-10-12 13:52 . 2004-08-16 15:40 69632 ----a-w- c:\windows\system32\raschap.dll
    2009-06-28 20:50 . 2009-06-28 20:50 1878888 ----a-w- c:\program files\install_flash_player.exe
    2009-06-16 20:21 . 2009-06-16 20:21 16755276 ----a-w- c:\program files\tuxguitar-1.1-windows-x86-jet.exe
    2009-02-24 19:34 . 2009-02-24 19:34 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
    2007-12-10 15:40 . 2007-12-10 15:40 6275816 ----a-w- c:\program files\mozilla firefox\plugins\ScorchPDFWrapper.dll
    2009-02-24 19:34 . 2009-02-24 19:34 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
    .

    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SmpcSys"="c:\apps\SMP\SmpSys.exe" [2005-11-17 975360]
    "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
    "Google Update"="c:\documents and settings\Paca_SuperStar\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-07 133104]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
    "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
    "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
    "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-03-10 98394]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-03-10 688218]
    "Raccourci vers la page des propriétés de High Definition Audio"="HDAShCut.exe" [2005-01-07 61952]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-27 7561216]
    "nwiz"="nwiz.exe" [2006-04-27 1519616]
    "RTHDCPL"="RTHDCPL.EXE" [2006-06-01 16208384]
    "SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
    "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "DetectorApp"="c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 102400]
    "ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
    "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
    "PCMService"="c:\apps\Powercinema\PCMService.exe" [2006-02-23 147456]
    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
    "PhiBtn"="c:\windows\System32\drivers\PhiBtn.exe" [2005-09-12 155648]
    "Traymin900"="c:\windows\System32\drivers\Tray900.exe" [2005-09-12 266240]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-08-10 98304]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

    c:\documents and settings\Paca_SuperStar\Menu D‚marrer\Programmes\D‚marrage\
    Notification de cadeaux MSN.lnk - c:\documents and settings\Paca_SuperStar\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe [2009-3-26 135680]
    OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-1-21 393216]

    c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%ProgramFiles%\\AOL 9.0\\aol.exe"=
    "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
    "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Documents and Settings\\Paca_SuperStar\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
    "c:\\Documents and Settings\\Paca_SuperStar\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
    "c:\\APPS\\skype\\Phone\\Skype.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

    R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [14/06/2008 11:39 114768]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [14/06/2008 11:39 20560]
    S3 camvid40;Philips SPC 900NC PC Camera;c:\windows\system32\drivers\camdrv41.sys [14/06/2008 12:59 1239552]

    --- Autres Services/Pilotes en mémoire ---

    *Deregistered* - knvppt
    .
    Examen supplémentaire
    .
    uStart Page = hxxp://www.google.fr/
    uInternet Connection Wizard,ShellNext = hxxp://www.avast.com/
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    FF - ProfilePath - c:\documents and settings\Paca_SuperStar\Application Data\Mozilla\Firefox\Profiles\uynga1x1.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
    FF - plugin: c:\documents and settings\Paca_SuperStar\Application Data\Mozilla\plugins\npgoogletalk.dll
    FF - plugin: c:\documents and settings\Paca_SuperStar\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
    FF - plugin: c:\program files\Picasa2\npPicasa3.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    .
    - - - - ORPHELINS SUPPRIMES - - - -

    HKLM-Run-VCheck - (no file)
    AddRemove-Dynamic Toolbar_is1 - c:\program files\Dynamic Toolbar\unins000.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-12-19 12:32
    Windows 5.1.2600 Service Pack 2 NTFS

    Recherche de processus cachés ...

    Recherche d'éléments en démarrage automatique cachés ...

    Recherche de fichiers cachés ...

    Scan terminé avec succès
    Fichiers cachés: 0

    **************************************************************************
    "ImagePath"="\"c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe\"\00\00\00\00\02\00\00\00¨
    [%\00«Ô’|\00\00\00\00\00\00\00\00\00\00\00\00(\00\00\00\00\00#\03pè\13\00pè\13\00\18î"


    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\knvppt]

    .
    CLES DE REGISTRE BLOQUEES

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
    "C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
    .
    Heure de fin: 2009-12-19 12:35:25
    ComboFix-quarantined-files.txt 2009-12-19 11:35

    Avant-CF: 61 409 779 712 octets libres
    Après-CF: 61 648 752 640 octets libres

    - - End Of File - - 74A207AD94D105C8830D8F7135FCD38C

    Then I ran a nex HiJackThis scan:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:38:32, on 19/12/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16945)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
    c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
    c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
    C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
    c:\APPS\Powercinema\Kernel\TV\CLSched.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
    C:\APPS\Powercinema\PCMService.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\APPS\SMP\SmpSys.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Documents and Settings\Paca_SuperStar\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.avast.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAShCut.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [DetectorApp] C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [PCMService] "c:\APPS\Powercinema\PCMService.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [PhiBtn] %SystemRoot%\System32\drivers\PhiBtn.exe
    O4 - HKLM\..\Run: [Traymin900] %SystemRoot%\System32\drivers\Tray900.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Paca_SuperStar\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\Paca_SuperStar\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
    O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
    O23 - Service: CyberLink Media Library Service - Cyberlink - c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
    O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 8793 bytes

    Thnxs for your help!
    Pascale
  • chiazchiaz
    edited December 2009
    Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

    It's IMPORTANT to carry out the instructions in the sequence listed below.
    1. Close any open browsers.
    2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    Open *notepad* and copy/paste the text in the quotebox below into it:
    Driver::
knvppt

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\knvppt]

File::
c:\windows\system32\drivers\knvppt.sys
c:\windows\system32\fjhdyfhsn.bat

    Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.


    CFScript.gif

    Refering to the picture above, drag CFScript.txt into ComboFix.exe


    When finished, it shall produce a log for you at C:\ComboFix.txt

    Please copy and paste the ComboFix.txt in your new reply, as well as let me know how your PC is running now.

    *Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall. Altering this script in any way could damage your computer.*
  • Sunshine
    edited December 2009
    Hello,

    I have followed the above instructions.
    AVAST stopped sending me those annoying warning messages.
    Is seems that my PC is going well. Do you think that is the case? or is it possible that there is hidden troubles that i did not notice?

    If everything is OK now, do you think that staying with AVAST and ZoneALarm running on my PC is a good option?, or shall I search for another antvirus solution?

    Another question (the last!): with this virus issue, i have discovered this kind of forums and that people like you take time to solve the virus issues that people like me encounter.
    This would have cost me something to get it repaired (or reinstalled) .. therefore, I want to help those people that work at developping all those malware programs. I have seen a paypal link on the computerbleeping.com website. Therefore I think i will go there to give a contribution; or is there another website/organisation you would suggest?



    Below is the ComboFIx log:

    ComboFix 09-12-18.02 - Paca_SuperStar 19/12/2009 20:17:58.2.2 - x86
    Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.895.436 [GMT 1:00]
    Lancé depuis: c:\program files\kittyfix\KittyFix.exe
    Commutateurs utilisés :: c:\program files\kittyfix\CFScript.txt
    AV: avast! antivirus 4.8.1368 [VPS 091219-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
    FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

    FILE ::
    "c:\windows\system32\drivers\knvppt.sys"
    "c:\windows\system32\fjhdyfhsn.bat"
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\drivers\knvppt.sys
    c:\windows\system32\fjhdyfhsn.bat

    .
    ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    \Legacy_KNVPPT
    \Service_knvppt


    ((((((((((((((((((((((((((((( Fichiers créés du 2009-11-19 au 2009-12-19 ))))))))))))))))))))))))))))))))))))
    .

    2009-12-19 19:06 . 2009-12-19 19:06
    d
    w- c:\windows\LastGood.Tmp
    2009-12-19 11:19 . 2009-12-19 19:17
    d
    w- c:\program files\kittyfix
    2009-12-18 18:45 . 2007-12-24 16:37 138384 ----a-w- c:\windows\system32\drivers\tmcomm.sys
    2009-12-18 18:43 . 2009-12-19 11:07
    d
    w- c:\windows\system32\HouseCall 6.6
    2009-12-13 23:03 . 2009-12-13 23:03
    d
    w- c:\documents and settings\Paca_SuperStar\Application Data\Malwarebytes
    2009-12-13 23:03 . 2009-12-03 15:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-12-13 23:03 . 2009-12-13 23:03
    d
    w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-12-13 23:03 . 2009-12-13 23:03
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-12-13 23:03 . 2009-12-03 15:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-12-13 22:37 . 2009-12-13 22:37
    d
    w- c:\program files\Trend Micro

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-12-19 19:28 . 2008-07-27 11:57 1409056 --sha-w- c:\windows\system32\drivers\fidbox.dat
    2009-12-19 19:25 . 2008-07-27 11:57 17516 --sha-w- c:\windows\system32\drivers\fidbox.idx
    2009-12-19 19:09 . 2008-06-14 11:45 1 ----a-w- c:\documents and settings\Paca_SuperStar\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
    2009-12-19 19:05 . 2008-06-14 11:44
    d
    w- c:\documents and settings\Paca_SuperStar\Application Data\OpenOffice.org2
    2009-12-19 19:01 . 2009-05-23 12:02 6218172 ----a-w- c:\windows\Internet Logs\tvDebug.zip
    2009-12-14 22:39 . 2004-08-16 15:41 85842 ----a-w- c:\windows\system32\perfc00C.dat
    2009-12-14 22:39 . 2004-08-16 15:41 513736 ----a-w- c:\windows\system32\perfh00C.dat
    2009-12-13 22:13 . 2009-12-13 22:12 16 ----a-w- c:\windows\system32\config\systemprofile\Application Data\fvgqad.dat
    2009-12-12 00:14 . 2008-06-14 11:08 4212 ---h--w- c:\windows\system32\zllictbl.dat
    2009-12-04 09:03 . 2009-12-04 09:03 251376 ----a-w- c:\documents and settings\Paca_SuperStar\Application Data\Mozilla\plugins\npgoogletalk.dll
    2009-11-24 23:54 . 2008-06-14 10:38 1280480 ----a-w- c:\windows\system32\aswBoot.exe
    2009-11-24 23:51 . 2008-06-14 10:39 93424 ----a-w- c:\windows\system32\drivers\aswmon.sys
    2009-11-24 23:50 . 2008-06-14 10:39 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys
    2009-11-24 23:50 . 2008-06-14 10:39 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2009-11-24 23:50 . 2008-06-14 10:39 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2009-11-24 23:49 . 2008-06-14 10:39 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2009-11-24 23:48 . 2008-06-14 10:39 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2009-11-24 23:47 . 2008-06-14 10:39 27408 ----a-w- c:\windows\system32\drivers\aavmker4.sys
    2009-11-24 23:47 . 2008-06-14 10:39 97480 ----a-w- c:\windows\system32\AvastSS.scr
    2009-11-17 21:05 . 2008-07-07 20:05
    d
    w- c:\documents and settings\Paca_SuperStar\Application Data\dvdcss
    2009-11-11 21:34 . 2008-06-14 14:43
    d
    w- c:\program files\Google
    2009-10-29 07:44 . 2004-08-16 15:41 832512
    w- c:\windows\system32\wininet.dll
    2009-10-29 07:44 . 2004-08-16 15:40 78336 ----a-w- c:\windows\system32\ieencode.dll
    2009-10-29 07:44 . 2004-08-16 15:40 17408
    w- c:\windows\system32\corpol.dll
    2009-10-21 06:03 . 2004-08-16 15:41 75776 ----a-w- c:\windows\system32\strmfilt.dll
    2009-10-21 06:03 . 2004-08-16 15:40 25088 ----a-w- c:\windows\system32\httpapi.dll
    2009-10-20 14:58 . 2004-08-03 21:00 263552 ----a-w- c:\windows\system32\drivers\http.sys
    2009-10-13 10:52 . 2004-08-16 15:40 267776 ----a-w- c:\windows\system32\oakley.dll
    2009-10-12 13:52 . 2004-08-16 15:41 113152 ----a-w- c:\windows\system32\rastls.dll
    2009-10-12 13:52 . 2004-08-16 15:40 69632 ----a-w- c:\windows\system32\raschap.dll
    2009-06-28 20:50 . 2009-06-28 20:50 1878888 ----a-w- c:\program files\install_flash_player.exe
    2009-06-16 20:21 . 2009-06-16 20:21 16755276 ----a-w- c:\program files\tuxguitar-1.1-windows-x86-jet.exe
    2009-02-24 19:34 . 2009-02-24 19:34 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
    2007-12-10 15:40 . 2007-12-10 15:40 6275816 ----a-w- c:\program files\mozilla firefox\plugins\ScorchPDFWrapper.dll
    2009-02-24 19:34 . 2009-02-24 19:34 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
    .

    ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SmpcSys"="c:\apps\SMP\SmpSys.exe" [2005-11-17 975360]
    "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
    "Google Update"="c:\documents and settings\Paca_SuperStar\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-07 133104]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
    "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
    "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
    "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-03-10 98394]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-03-10 688218]
    "Raccourci vers la page des propriétés de High Definition Audio"="HDAShCut.exe" [2005-01-07 61952]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-04-27 7561216]
    "nwiz"="nwiz.exe" [2006-04-27 1519616]
    "RTHDCPL"="RTHDCPL.EXE" [2006-06-01 16208384]
    "SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
    "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "DetectorApp"="c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 102400]
    "ISUSPM Startup"="c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
    "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
    "PCMService"="c:\apps\Powercinema\PCMService.exe" [2006-02-23 147456]
    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
    "PhiBtn"="c:\windows\System32\drivers\PhiBtn.exe" [2005-09-12 155648]
    "Traymin900"="c:\windows\System32\drivers\Tray900.exe" [2005-09-12 266240]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-08-10 98304]
    "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

    c:\documents and settings\Paca_SuperStar\Menu D‚marrer\Programmes\D‚marrage\
    Notification de cadeaux MSN.lnk - c:\documents and settings\Paca_SuperStar\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe [2009-3-26 135680]
    OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-1-21 393216]

    c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%ProgramFiles%\\AOL 9.0\\aol.exe"=
    "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"=
    "%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Documents and Settings\\Paca_SuperStar\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
    "c:\\Documents and Settings\\Paca_SuperStar\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
    "c:\\APPS\\skype\\Phone\\Skype.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

    R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [14/06/2008 11:39 114768]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [14/06/2008 11:39 20560]
    S3 camvid40;Philips SPC 900NC PC Camera;c:\windows\system32\drivers\camdrv41.sys [14/06/2008 12:59 1239552]
    .
    Examen supplémentaire
    .
    uStart Page = hxxp://www.google.fr/
    uInternet Connection Wizard,ShellNext = hxxp://www.avast.com/
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    FF - ProfilePath - c:\documents and settings\Paca_SuperStar\Application Data\Mozilla\Firefox\Profiles\uynga1x1.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
    FF - plugin: c:\documents and settings\Paca_SuperStar\Application Data\Mozilla\plugins\npgoogletalk.dll
    FF - plugin: c:\documents and settings\Paca_SuperStar\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
    FF - plugin: c:\program files\Picasa2\npPicasa3.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-12-19 20:28
    Windows 5.1.2600 Service Pack 2 NTFS

    Recherche de processus cachés ...

    Recherche d'éléments en démarrage automatique cachés ...

    Recherche de fichiers cachés ...

    Scan terminé avec succès
    Fichiers cachés: 0

    **************************************************************************
    "ImagePath"="\"c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe\"\00\00\00\00\02\00\00\00¨
    [%\00«Ô’|\00\00\00\00\00\00\00\00\00\00\00\00(\00\00\00\00\00#\03pè\13\00pè\13\00\18î"

    .
    CLES DE REGISTRE BLOQUEES

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
    "C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
    .
    DLLs chargées dans les processus actifs

    - - - - - - - > 'explorer.exe'(3468)
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    c:\windows\system32\browselc.dll
    c:\program files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    c:\program files\Microsoft Office\OFFICE11\msohev.dll
    c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
    .
    Autres processus actifs
    .
    c:\program files\Alwil Software\Avast4\aswUpdSv.exe
    c:\program files\Alwil Software\Avast4\ashServ.exe
    c:\progra~1\FICHIE~1\AOL\ACS\AOLacsd.exe
    c:\apps\Powercinema\Kernel\TV\CLCapSvc.exe
    c:\apps\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
    c:\windows\system32\nvsvc32.exe
    c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
    c:\program files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
    c:\apps\Powercinema\Kernel\TV\CLSched.exe
    c:\program files\Alwil Software\Avast4\ashMaiSv.exe
    c:\program files\Alwil Software\Avast4\ashWebSv.exe
    c:\windows\RTHDCPL.EXE
    c:\program files\OpenOffice.org 2.4\program\soffice.exe
    c:\program files\OpenOffice.org 2.4\program\soffice.BIN
    .
    **************************************************************************
    .
    Heure de fin: 2009-12-19 20:33:55 - La machine a redémarré
    ComboFix-quarantined-files.txt 2009-12-19 19:33
    ComboFix2.txt 2009-12-19 11:35

    Avant-CF: 61 618 511 872 octets libres
    Après-CF: 61 500 354 560 octets libres

    - - End Of File - - AFAE3011AFA3DE35DF306BB407305F09
  • chiazchiaz
    edited December 2009
    Sorry for the late response.

    Avast is a decent anti-virus program, so I'd stay with it if you are already comfortable with using it.

    Donation link for ComboFix:
    http://www.bleepingcomputer.com/combofix/how-to-use-combofix

    To support MalwareBytes, you can purchase their pro version which offers a number of extra features.
    http://www.malwarebytes.org/mbam.php

    ===============

    Anyway, how's your PC running now?
  • Sunshine
    edited December 2009
    My PC is running well.
    Many thanxs for your help.
    I wish you a merry christmas if you celebrate it, a happy end of 2009 and a very good year in 2010!
    (However..I have to admit that I hope my PC will remain clean and that I won't have to deal with you in 2010 :D)

    Best regards,
    Pascale
  • chiazchiaz
    edited December 2009
    It's time to remove ComboFix.

    Go to to Start > Run
    Type in box

    combofix /u

    Note: the space between the X and the /u

    Press Enter.

    This command will:

    Delete the following:
    ComboFix and its associated files and folders.
    VundoFix backups, if present
    The C:\Deckard folder, if present
    The C:_OtMoveIt folder, if present

    Reset the clock settings.
    Hide file extensions, if required.
    Hide System/Hidden files, if required.
    Reset System Restore.


    I sure hope I don't see you again. :D
  • Sunshine
    edited December 2009
    Ok! I will remove Combofix as soon as i am back home... on january 4th.

    Rgds,
    Pascale
  • Sunshine
    edited January 2010
    Sunshine wrote:
    Ok! I will remove Combofix as soon as i am back home... on january 4th.

    Rgds,
    Pascale

    I have removed Combofix.
    Everything is back to normal!

    Many thanxs for your help and happy new year!

    Pascale
  • chiazchiaz
    edited January 2010
    You're welcome Pascale.

    I will move this to the Resolved section shortly.
Sign In or Register to comment.